On Friday 22 September 2023 at 13:24 UTC, a ACK flood targeted a retail banking customer in Central Europe. The attack peaked at 371.0 Gbps and lasted 88 minutes. Traffic originated from 3950 autonomous systems in 11 countries, predominantly a Mirai-derived IoT botnet.
| Vector | ACK flood |
| Peak | 371.0 Gbps |
| Duration | 88 min |
| Time to mitigation | 0.850 s |
| Attack traffic reaching origin | 0.007% |
| Legitimate traffic challenged | 0.19% |
Timeline
The attack was preceded by a hacktivist channel announcing the target. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 12 points of presence.
What the customer saw
A brief increase in p99 latency of 76 ms during the first minute, then normal service.
Recommendations
- Keep origin IPs out of public DNS history.
- Add a dedicated rate limit for the targeted route.
- Enable authenticated origin pulls.
How do you avoid challenging uptime monitors and partners?
Do you publish the edge IP ranges in a machine-readable format?
Nice to read a vendor blog that admits what went wrong.
Thanks! Yes — the risk score and its components are included in every log record.
Any plans to support per-tenant limits keyed on a JWT claim?
Great to hear, thanks for sharing your experience.
Clear and practical, thanks.
How do you avoid challenging uptime monitors and partners?
Do you publish the edge IP ranges in a machine-readable format?
Thanks! Yes — the risk score and its components are included in every log record.
Any plans to support per-tenant limits keyed on a JWT claim?